Skip to main content

Testing and Quality

Current Coverage​

The repository includes tests for the critical implementation surfaces:

  • apps/api/src/middleware/auth.middleware.test.ts
  • apps/api/src/middleware/rbac.middleware.test.ts
  • apps/api/src/middleware/tenant.isolation.test.ts
  • apps/api/src/services/ingestion.idempotency.test.ts
  • apps/api/src/routes/redemption-concurrency.test.ts
  • apps/api/src/routes/admin-workflows.test.ts
  • apps/api/src/services/merchant-analytics.test.ts
  • apps/api/src/services/clover-poll.test.ts
  • apps/api/src/services/clover-adapter.test.ts
  • apps/api/src/lib/brand-identity.test.ts
  • packages/reward-engine/src/promotions.test.ts
  • packages/reward-engine/src/evaluate.test.ts
  • packages/rbac/src/permissions.test.ts
  • apps/api/src/lib/campaign-render.test.ts
  • apps/api/src/lib/clover.test.ts
  • apps/api/src/lib/resend-from.test.ts
  • apps/api/src/services/campaign-audience.test.ts
  • apps/api/src/lib/webhook-signature.test.ts

These tests cover auth and RBAC, tenant isolation, ingestion idempotency, redemption concurrency, admin workflows, merchant analytics, Clover polling and normalization, brand identity, promotion math, reward calculation, campaign rendering, and webhook signatures.

Quality Gates​

Workspace scripts enforce the main quality checks:

  • pnpm lint
  • pnpm typecheck
  • pnpm test
  • pnpm build

TypeScript is configured for strict mode with noUncheckedIndexedAccess and exactOptionalPropertyTypes.

Active Deployment Workflows​

API deploy workflow​

.github/workflows/deploy-api.yml:

  1. Loads environment variables from Bitwarden Secrets Manager.
  2. Syncs them to Render.
  3. Triggers a Render deploy.

Web deploy workflow​

.github/workflows/deploy.yml:

  1. Loads web env vars from Bitwarden Secrets Manager.
  2. Builds apps/web.
  3. Publishes the build to Cloudflare Pages.

Lint and Type Rules​

The workspace ESLint config is intentionally strict:

  • no any
  • no floating promises
  • explicit module boundary types
  • unknown in catch callbacks

These rules are meant to keep the API and shared packages predictable.

Current Gaps​

Remaining gaps include:

  1. End-to-end merchant onboarding coverage.
  2. Square polling watermark progression tests.
  3. Email send-path tests beyond rendering and sender normalization.

Practical Release Checklist​

Before a release, the repo should have:

  • pnpm lint passing
  • pnpm typecheck passing
  • pnpm test passing
  • a successful workspace build
  • the API deploy workflow green
  • the web deploy workflow green
Last updated on
Written byDhruv Doshi